chore(deps): update module go.yaml.in/yaml/v2 to v3 (main)

[tempo-ci-app]

What this PR does:

Automated CI fix for #7284, which Renovate can't self-resolve. This branch is that PR's head plus the fix; merging it lands the dependency update with CI green.

yaml.v3 changes the Unmarshaler signature (now takes *yaml.Node), removes UnmarshalStrict / Decoder.SetStrict (renamed to KnownFields), and changes default sequence indentation; updated all in-repo UnmarshalYAML implementations and call sites, added YAMLUnmarshalStrict and YAMLMarshalIndent2 helpers in pkg/util, and regenerated one migrate-config snapshot fixture to match v3 list indentation.

Which issue(s) this PR fixes:

Supersedes #7284

Checklist

• Tests updated
• Documentation added
• Changelog entry added under .chloggen/ (run make chlog-new, or make chlog-new FILENAME=<name> to override the default branch-name file; see .chloggen/README.md)

[github-actions]

⚠️ The workflow jobs listed below don't declare a permissions: block and may break when the organization's default GITHUB_TOKEN permissions are restricted to read-only.

Expand for findings

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/deploy-pr-preview.yml:13:3
   |
13 | /   deploy-pr-preview:
14 | |     if: "!github.event.pull_request.head.repo.fork"
15 | |     uses: grafana/writers-toolkit/.github/workflows/deploy-preview.yml@4dbecae7443c69b3e5fdfeeac7037a339cb82e4c # main
16 | |     with:
...  |
31 | |       title: ${{ github.event.pull_request.title }}
   | |                                                    ^
   | |                                                    |
   | |____________________________________________________this job
   |                                                      default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

[github-actions]

This PR has been automatically marked as stale because it has not had any activity in the past 60 days.
The next time this stale check runs, the stale label will be removed if there is new activity. This pull request will be closed in 15 days if there is no new activity.
Please apply keepalive label to exempt this Pull Request.